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Amendments to the Specification 

Please replace the paragraph at page 9, lines 11 through 21 with the following amended 
paragraph: 

In certain cases several sets of fingerprints are computed for a Software, perhaps arising 
from several executions of said software and possibly including examinations of files on disk. 
These sets can be combined in a variety of ways to form a superfingerprint for the software. One 
way is to intersect the sets. Another is to take those fingerprints that appear in more than a 
specified number of sets. The superfingerprint may then be reduced by excluding fingerprints 
associated with specified other softwares. If the superfingerprint is for a subfunction of a larger 
Software, the superfingerprint may [[be]] consist of the set of fingerprints found when the larger 
Software executes that subfunction less the set of fingerprints found when the larger Software 
does not execute that subfunction. All these means of constructing superfingerprints are 
collectively called combining rules. 


